QUIC Fingerprinting in EVE

Snort can identify client applications in Quick UDP Internet Connections (QUIC sessions) based on EVE. QUIC fingerprinting can:

• Detect applications over QUIC without enabling decryption.

• Identify malware without enabling decryption.

• Detect service applications. You can assign access control rules based on the service detected over the QUIC protocol.